vyommani opened a new pull request, #1329:
URL: https://github.com/apache/ranger/pull/1329
## What changes were proposed in this pull request?
RANGER-5858: return constraints (RANGER-5848) in the authz API result, so
PDP and authz API callers such as the Agent Harness receive constraints like
`requireApproval`.
- `RangerAuthzResult.ConstraintResult`: `name`, `parameters`, `policy` (id,
version), `policyPriority`.
- `constraints` on `ResultInfo` and `PermissionResult`, next to `dataMask`
and `rowFilter`; each permission and sub-resource result carries its own. Left
out of the JSON when empty.
- `RangerAuthzPlugin` copies `RangerAccessResult.getConstraints()` into the
result when access is allowed, sorted with
`RangerConstraintResult.CONSTRAINT_RESULT_COMPARATOR`. No constraints are
returned on deny or when access is not determined.
- `authz-api` does not depend on agents-common types, so the match type is
not returned.
The policy engine populates constraints only after RANGER-5842, so until
then the response doesn't change.
Not in this change: the caller declaring supported constraints and
deny-if-unsupported , and audit.
## How was this patch tested?
- `TestRangerAuthzResult` (authz-api): `PermissionResult` copies constraints
from `ResultInfo`; equals and hashCode include them; `ConstraintResult`
accessors and equality.
- `TestRangerAuthzPluginConstraints` (authz-embedded):
- allowed: constraints returned, sorted by name, then OVERRIDE before
NORMAL, then policy id;
- none when nothing matched, on deny, and when access is not determined;
- parameters are copied;
- JSON round-trip of `RangerAuthzResult` with constraints, and the field
omitted when empty.
- `mvn -pl authz-api,authz-embedded -am checkstyle:check test`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
